CVE-2026-82289

Received Received - Intake

Gitingest Hostname Spoofing Leads to Credential Exposure

Publication date: 2026-08-28

Last updated on: 2026-08-28

Assigner: VulnCheck

Description

Gitingest through 0.3.1 fails to properly validate hostnames in _validate_host, accepting any host with a git., gitlab., or github. prefix regardless of known-hosts list membership. Attackers can submit URLs with attacker-controlled hostnames to trigger outbound connections to arbitrary hosts and disclose GitHub personal access tokens via HTTP basic credentials.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-28

Last Modified

2026-08-28

Generated

2026-08-29

AI Q&A

2026-08-29

EPSS Evaluated

N/A

NVD

CVE-2026-82289

EUVD

EUVD-2026-67820

Affected Vendors & Products

Vendor	Product	Version / Range
coderamp_labs	gitingest	to 0.3.1 (inc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-918	The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.

Attack-Flow Graph

Executive Summary

CVE-2026-82289 is a Server-Side Request Forgery (SSRF) vulnerability in Gitingest through version 0.3.1. It occurs because the tool fails to properly validate hostnames in URLs. The _validate_host function accepts any host with prefixes like git., gitlab., or github., even if the host is not in the known-hosts list. Attackers can exploit this by submitting malicious URLs that trick the tool into making outbound connections to arbitrary servers. If a GitHub Personal Access Token (PAT) is provided, the token may be exposed via HTTP basic authentication credentials.

Detection Guidance

To detect this vulnerability, monitor outbound network connections from systems running Gitingest 0.3.1 or earlier. Look for connections to hosts with git., gitlab., or github. prefixes that are not standard Git hosting domains. Check logs for URLs containing these prefixes and HTTP basic authentication attempts.

Impact Analysis

This vulnerability can lead to unauthorized access to internal network services through SSRF. If you use Gitingest with a GitHub PAT, attackers may steal your token, gaining full access to your GitHub repositories and sensitive data. Attackers could also probe internal systems or exfiltrate data via crafted URLs.

Compliance Impact

This vulnerability may violate GDPR due to unauthorized data exposure and potential loss of personal data. For HIPAA, if GitHub repositories contain protected health information, token theft could lead to breaches. Organizations using Gitingest must ensure proper access controls and token handling to maintain compliance.

Mitigation Strategies

Immediately upgrade Gitingest to a patched version beyond 0.3.1. Disable or restrict outbound network access for Gitingest processes. Review and revoke any exposed GitHub personal access tokens. Implement strict hostname validation in URL parsing to only allow known Git hosting domains.

Hi! I’m here to help you understand CVE-2026-82289. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70